Use of Incorrectly-Resolved Name or Reference in c-ares - #VU156258

Vulnerability details

The vulnerability allows a remote attacker to cause an application to receive DNS answers inconsistent with its requested EDNS options.

The vulnerability exists due to omission of EDNS options from cache keys in the c-ares query cache when processing otherwise identical DNS lookups with different EDNS options. A remote attacker can exploit reuse of a cached answer across these lookups to cause an application to receive an answer lacking requested DNSSEC records or generated for a different EDNS Client Subnet.

The affected usage is applications submitting their own requests through ares_send_dnsrec() with varying EDNS options on one channel. The ares_getaddrinfo(), ares_query(), ares_search() and similar interfaces are not affected.

Affected software

Remediation

External References

• https://github.com/c-ares/c-ares/security/advisories/GHSA-wrgc-prmw-27xh
• https://github.com/c-ares/c-ares/commit/a21160045f9d7039225fa285be7cb1b02173a3a5

Related Security Bulletins

• Multiple vulnerabilities in c-ares